TODAY
Old Struts flaw and critical edge-device bugs are all being actively exploited
THE THREE
- KEV#1 · CVE-2016-3081
Apache
What: Attackers can run their own code on unpatched Apache Struts servers, usually through older internal or forgotten web apps. A successful hit means server takeover and a foothold in your network. It has a 96% exploit-odds score and was added to the Known-Exploited list 8 days ago.
Why it moved: Actively exploited · Everyone runs this · 96% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Upgrade Apache Struts or disable Dynamic Method Invocation today.
- KEV#2 · CVE-2026-85706
Gitlab
What: Anyone on the internet can read arbitrary files on an unpatched GitLab server without logging in. That can expose source code, secrets and credentials, which attackers then use to break in elsewhere. It scores a perfect 10.0 CVSS and has been exploited for 35 days.
Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Patch GitLab to the fixed version and rotate stored secrets.
- KEV#3 · CVE-2026-20079
Cisco
What: Attackers can bypass login on Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management without credentials. Whoever controls the firewall manager controls your network defenses. It scores 10.0 CVSS and has been exploited for 37 days.
Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Cisco's fix and restrict FMC access to admin networks.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 12M
- Relationships
- 67M
- Threat actors
- 246
- Indicators
- 993k
- Feeds live
- 20
- Sources total
- 24
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.